Checkmarx SCA

Checkmarx SCA is the Software Composition Analysis engine inside Checkmarx One. It scans open-source dependencies in package manifests (package.json, pom.xml, requirements.txt, go.mod, Cargo.toml, Gemfile, composer.json, build.gradle, *.csproj) and the resolved transitive graph, then matches against the CVE database, license catalog, and known-bad indicators. Same shape as Snyk SCA, Black Duck, or Sonatype Lifecycle, with the differentiator being how Checkmarx reduces the noise.

Exploitable Path Analysis (EPA) is the load-bearing capability. A traditional SCA tool reports every CVE in every dependency in the tree. Most of those CVEs sit in code paths that the application never calls. EPA performs reachability analysis on the customer's actual code (cross-checked with Checkmarx SAST) and downgrades CVEs in unreachable code to a lower severity. On portfolios with deep dependency trees, EPA reduces the AppSec backlog by a meaningful margin because findings reflect what an attacker can exploit instead of every theoretically vulnerable line.

License compliance is the other half of SCA. Programs that ship code with copyleft licenses (GPL, AGPL) into proprietary products create legal exposure. Checkmarx SCA evaluates every dependency against a configurable license policy and flags forbidden licenses before they reach production. License policy is per-application or per-business-unit so internal-only tooling does not get audited like a customer-facing SaaS product.

What stalls SCA adoption is alert fatigue. Programs that take vendor-default policies, ignore EPA, and route every CVE finding to the developer queue burn out the engineering organization and the AppSec team simultaneously. Merito's engagement starts with EPA on by default, license-policy tuning, suppression workflow with audit trail, and developer-time integration that surfaces findings during PR review rather than as a separate dashboard. Without that, SCA generates more noise than it removes.

Merito has audited SCA programs that ran clean reports against vendor defaults, generated 30,000 open CVE findings across the portfolio, and shipped exactly zero remediations because the engineering organization correctly recognized the backlog as noise. The fix is reachability. Checkmarx EPA cross-checks SCA findings against SAST flow paths and demotes CVEs in code paths that are not actually called from production. On real portfolios that turns a flat 30,000-finding list into a several-thousand-finding queue AppSec can actually work.

Merito recommends Checkmarx SCA specifically when reachability matters, when license discipline needs per-application granularity, and when consolidation onto Checkmarx One pays back the integration cost. For programs already running mature Snyk SCA pipelines with reachability turned on, replacing them with Checkmarx is a 12-month project that often does not deliver enough delta to justify the disruption. Merito runs that decision honestly.

The pairing with Malicious Package Protection and Repository Health is the load-bearing move on supply-chain governance. SCA finds risk in dependencies that are already in the build; Malicious Package Protection blocks supply-chain attacks at registry-fetch time; Repository Health scores the OSS project hygiene before the dependency enters the tree. Programs running SCA without sourcing-time controls are doing periodic detection rather than active prevention.